PT-2025-16925 · Visicut · Visicut

Published 2025-04-17 · Updated 2025-09-24 · CVE-2025-43708

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions VisiCut version 2.1

Description The issue is related to insecure deserialization, where VisiCut 2.1 allows stack consumption via an XML document with nested set elements. This can be demonstrated by a java.util.HashMap StackOverflowError when the reference variable is set to '../../../set/set[2]'.

Recommendations For VisiCut version 2.1, consider restricting the use of nested set elements in XML documents to minimize the risk of stack consumption until a patch is available. Avoid using the reference variable with values that could lead to nested set elements, such as '../../../set/set[2]', in XML documents until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2025-43708

Affected Products

Visicut

References · 9

• 🔥 https://github.com/Gelcon/PoC-of-VisiCut2_1-Stack-Overflow-Vul · Exploit
• https://osv.dev/vulnerability/CVE-2025-43708 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-43708 · Security Note
• https://github.com/t-oster/VisiCut · Note
• https://t.me/cvetracker/21830 · Telegram Post
• https://t.me/cvedetector/23207 · Telegram Post
• https://visicut.org · Note
• https://twitter.com/CVEnew/status/1912722249192186254 · Twitter Post
• https://t.me/cveNotify/136235 · Telegram Post